NEAS[.]3158c492b26b25b7c87a1c28207fd060[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.3158c492b26b25b7c87a1c28207fd060.exe
Size

66KB
MD5

3158c492b26b25b7c87a1c28207fd060
SHA1

221114e9ee597618cc9d8cef66f2cd917ab9d45d
SHA256

faded8702f46a6fadfbba2ecf3bc5d4cedabc80a56d5ec42611079d27cf42a33
SHA512

5e54ad898c3c6984135d7ac05e257a725cb84e0a0ecb4e6c8c44fa083a0d8e28ac7d6bd1efb678bdeb0a8e2f2d89d106573127acfb7af02f793163315d193b18
SSDEEP

1536:A+6k7jPsygotsAHlWwsOjJW9YeDbi+Ybr:A+17DsA0OVGbi+Ybr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.3158c492b26b25b7c87a1c28207fd060.exe

Files

NEAS.3158c492b26b25b7c87a1c28207fd060.exe
.exe windows:4 windows x86

9f68c6d0d93178b6bedb4c876954f317

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

BasepCheckWinSaferRestrictions
SetFileApisToOEM
CheckNameLegalDOS8Dot3A
InitializeSRWLock
SetFirmwareEnvironmentVariableA
RegQueryInfoKeyA
GetErrorMode
WerUnregisterRuntimeExceptionModuleWorker
ConvertThreadToFiber

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE